The Session Initiation Protocol (SIP) is a signaling protocol that provides a mechanism for a computing device to locate another device it wants to communicate with over a computer network and to establish a communication session therewith. SIP is a versatile protocol and has been used for establishing communication sessions in many different scenarios. For instance, SIP is used for Internet conferencing, telephony, presence, event notification, and instant messaging. An important strength of SIP is its support of personal mobility by providing the ability to reach a called party (user) under a single, location-independent address even when the called party has moved to a different computer.
One common mode of session initiation operation under the SIP is the “proxy mode.” By way of example, a SIP client (the “caller”) may send a SIP request message, such as an INVITE message, identifying the intended recipient (the “callee”) by an e-mail like address. This request message is typically first sent to an outbound SIP proxy of the sending SIP client. The outbound SIP proxy then forwards the request message, often through other intermediate SIP proxies, to an SIP proxy with which the intended recipient client has registered, which then sends the INVITE to the recipient. The acceptance message (“200 OK”) of the recipient client is returned through the signaling chain to the caller, which can then communicate with the callee through a media channel that is typically different from the signaling channel. Besides communicating with another SIP client, a SIP client may also talk to SIP servers for purposes such as registering itself with a SIP registrar by sending a REGISTER request.
Although SIP has been widely implemented for various applications, it was designed mainly for signaling operations. It does not explicitly provide or require a security mechanism for protecting the security and privacy of the communication sessions. In many cases, however, it is desirable to require a SIP client that sends a request to authenticate its user to an outbound SIP proxy, and to also require the proxy to authenticate itself to the SIP client. Moreover, it is also often necessary to protect the integrity of the SIP request messages. Both the client-proxy authentication and message integrity require the use of a reliable security mechanism. Thus, there is a need to combine a reliable security mechanism with the SIP signaling operation to allow authentication between a SIP client and an outbound SIP proxy. The technical challenge is, however, how to fit the desired security mechanism into the SIP signaling framework so that the two mechanisms for different purposes can be performed together effectively.